When sending a broadcast while at least on of the connected stations is
sleeping, it gets queued and send after a DTIM beacon is sent.
If the packet was to be sent on a vlan interface, the vif used for dequeing
from the per-bss queue does not hold the per-vlan sdata. The correct sdata is
required to use the correct per-vlan broadcast/multicast key.
Users are affected by not receiving the broadcasts indended for them, which for
example breaks ipv6 autoconf and therefore ipv6 connectivity. Further, they
might be affected as packets might be disclosed to non-intended stas, though
mixing vlan and non-vlan stas might be rare.
This problem is triggered more often by smartphones (which enabled me to track
it down) as they power sleep more often (I guess), but a single sleeping sta on
the ap stops the packet for all connected stas of the ap.
The problem exists in older kernels (at least 3.3.7) as well.
The following patch fixes this by restoring the per-vlan sdata using the
skb->dev entry.
This patch works for me with the vlan-interface within a bridge.
Is the bc_buf cleanup safe this way or does it need locks?
Would it be better to maintain the power sleeping state of the stas on a
per-interface basis, as this would permit one group of non-sleeping stas to
receive while another group has sleeping stas? Of course this would not
prevent non-targetted groups of stas to be waked up, but implementing the
latter sounds difficult to me.
Example old backtrace:
Using good key:
[ 301.020467] ieee80211_subif_start_xmit:2000 wlan0_2.501: multicast packet to 33:33:00:00:00:01
[ 301.029146] ieee80211_tx_prepare:1174 wlan0_2.501: multicast packet to 33:33:00:00:00:01
[ 301.037249] ieee80211_tx:1442 wlan0_2.501: multicast packet to 33:33:00:00:00:01
[ 301.044688] wlan0_2.501: packet to 33:33:00:00:00:01 using key type CCMP idx 1 len 16 data de 46 7b 31 4f a3 13 8b 88 0b 4e fb 3f 77 d0 18
Using wrong key:
[ 305.000447] ieee80211_subif_start_xmit:2000 wlan0_2.501: multicast packet to 33:33:00:00:00:01
[ 305.009136] ieee80211_tx_prepare:1174 wlan0_2.501: multicast packet to 33:33:00:00:00:01
[ 305.017238] ieee80211_tx:1442 wlan0_2.501: multicast packet to 33:33:00:00:00:01
[ 305.171713] ieee80211_tx_prepare:1174 wlan0: multicast packet to 33:33:00:00:00:01
[ 305.179314] ieee80211_get_buffered_bc:2797 wlan0: multicast packet to 33:33:00:00:00:01
[ 305.187359] wlan0: packet to 33:33:00:00:00:01 using key type CCMP idx 1 len 16 data ca 85 0f 27 80 78 83 09 49 7a fb c8 c4 dc 45 aa
Example new backtrace:
[ 3157.866478] ieee80211_subif_start_xmit:2000 wlan0_2.501: multicast packet to 33:33:00:00:00:16
[ 3157.875129] ieee80211_tx_prepare:1174 wlan0_2.501: multicast packet to 33:33:00:00:00:16
[ 3157.883227] ieee80211_tx:1442 wlan0_2.501: multicast packet to 33:33:00:00:00:16
[ 3157.916991] ieee80211_tx_prepare:1174 wlan0_2.501: multicast packet to 33:33:00:00:00:16
[ 3157.925111] ieee80211_get_buffered_bc:2798 wlan0_2.501: multicast packet to 33:33:00:00:00:16
[ 3157.933667] wlan0_2.501: packet to 33:33:00:00:00:16 using key type CCMP idx 1 len 16 data 2d 06 89 89 27 74 3e e6 53 22 4b d4 5e 50 c0 39
Michael Braun (2):
mac80211: free ps->bc_buf skbs on vlan device stop
mac80211: fix WPA with VLAN on AP side with ps-sta
net/mac80211/iface.c | 14 ++++++++++++++
net/mac80211/tx.c | 1 +
2 files changed, 15 insertions(+)
--
1.7.10.4
When sending a broadcast while at least on of the connected stations is
sleeping, it gets queued and send after a DTIM beacon is sent.
If the packet was to be sent on a vlan interface, the vif used for dequeing
from the per-bss queue does not hold the per-vlan sdata. The correct sdata is
required to use the correct per-vlan broadcast/multicast key.
This patch fixes this by restoring the per-vlan sdata using the skb->dev entry.
Signed-off-by: Michael Braun <[email protected]>
---
V2: fix compile warning
V3: simplify change
net/mac80211/tx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index f476aa6..71385bf 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2785,6 +2785,7 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
cpu_to_le16(IEEE80211_FCTL_MOREDATA);
}
+ sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
if (!ieee80211_tx_prepare(sdata, &tx, skb))
break;
dev_kfree_skb_any(skb);
--
1.7.10.4
Looks good, can you send them as [PATCH]? :)
johannes
When the vlan device is removed, ps->bc_buf processing can no longer
send its frames.
Signed-off-by: Michael Braun <[email protected]>
---
V4: Add this patch.
V5: add spin_lock, switch order of patches
net/mac80211/iface.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 40ff030..bb1cdc6 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -680,6 +680,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
struct sk_buff *skb, *tmp;
u32 hw_reconf_flags = 0;
int i, flushed;
+ struct ps_data *ps;
clear_bit(SDATA_STATE_RUNNING, &sdata->state);
@@ -758,6 +759,19 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
u.vlan.list)
dev_close(vlan->dev);
WARN_ON(!list_empty(&sdata->u.ap.vlans));
+ } else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+ /* remove all packets in parent bc_buf pointing to this dev */
+ ps = &sdata->bss->ps;
+
+ spin_lock_irqsave(&ps->bc_buf.lock, flags);
+ skb_queue_walk_safe(&ps->bc_buf, skb, tmp) {
+ if (skb->dev == sdata->dev) {
+ __skb_unlink(skb, &ps->bc_buf);
+ local->total_ps_buffered--;
+ kfree_skb(skb);
+ }
+ }
+ spin_unlock_irqrestore(&ps->bc_buf.lock, flags);
} else if (sdata->vif.type == NL80211_IFTYPE_STATION) {
ieee80211_mgd_stop(sdata);
}
--
1.7.10.4
On Wed, 2013-02-13 at 13:51 +0100, Michael Braun wrote:
> When the vlan device is removed, ps->bc_buf processing can no longer
> send its frames.
>
> Signed-off-by: Michael Braun <[email protected]>
> ---
> V4: Add this patch.
> V5: add spin_lock, switch order of patches
> net/mac80211/iface.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
> index 40ff030..bb1cdc6 100644
> --- a/net/mac80211/iface.c
> +++ b/net/mac80211/iface.c
> @@ -680,6 +680,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
> struct sk_buff *skb, *tmp;
> u32 hw_reconf_flags = 0;
> int i, flushed;
> + struct ps_data *ps;
>
> clear_bit(SDATA_STATE_RUNNING, &sdata->state);
>
> @@ -758,6 +759,19 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
> u.vlan.list)
> dev_close(vlan->dev);
> WARN_ON(!list_empty(&sdata->u.ap.vlans));
> + } else if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
> + /* remove all packets in parent bc_buf pointing to this dev */
> + ps = &sdata->bss->ps;
> +
> + spin_lock_irqsave(&ps->bc_buf.lock, flags);
> + skb_queue_walk_safe(&ps->bc_buf, skb, tmp) {
> + if (skb->dev == sdata->dev) {
> + __skb_unlink(skb, &ps->bc_buf);
> + local->total_ps_buffered--;
> + kfree_skb(skb);
Ok actually I guess I spoke too soon -- please also change kfree_skb()
to ieee80211_free_txskb()
johannes